What’s Vulnerable › Vulnerabilities

CVE-2026-89112: Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-15
• Weakness: CWE-862

Description

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

Affected products

• SAP_SE CLA-Assistant: through v2.13.1

References

• https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-8rcv-xqgf-8743
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-89112 or the next vulnerability affects your stack